Last Updated: 2026-08-26
Eddytor ApS (CVR DK42920673) engages the following subprocessors to deliver the Eddytor Service. We will provide at least 30 days' notice (by email or in-app) before adding a new subprocessor or replacing an existing one.
Infrastructure
Every Eddytor-developed service — REST API, engine, MCP endpoint, Flight SQL, web UI, and the metadata database — runs on one provider, in the EU.
| Subprocessor | Applicable services | Processing activities | Location |
|---|---|---|---|
| Hetzner Online GmbH | All services | Hosting of application nodes, the PostgreSQL metadata database, load balancing, and DNS. Processes everything Eddytor stores: accounts, organisations, table registrations, policies, audit log, and encrypted storage credentials. | Falkenstein, Germany (EU) |
Eddytor stores metadata, not table data. Your tables stay in the object store you connect, under your own cloud account and IAM. That object store (Azure Blob Storage / ADLS Gen2, Amazon S3, Google Cloud Storage, or an S3-compatible endpoint) is your processor, not ours: you choose the provider and the region.
| Subprocessor | Applicable services | Processing activities | Location |
|---|---|---|---|
| Intuit Inc. — Mailchimp Transactional (Mandrill) | All services | Delivery of transactional email: magic-link sign-in, organisation invitations, and service notices. Processes email addresses and message contents. | US, under Standard Contractual Clauses |
Analytics
| Subprocessor | Applicable services | Processing activities | Location |
|---|---|---|---|
| InnoCraft Ltd — Matomo Cloud | Web app (app.eddytor.com), website (eddytor.com) | Product and website analytics through Matomo Tag Manager: pages viewed, clicks, referrer, browser and device type. IP addresses are anonymised before storage (only the first two bytes are retained). No data is sold and none is shared with advertising networks. | Data hosted on AWS Europe in Germany, backups in Ireland. InnoCraft Ltd is based in New Zealand, which the European Commission recognises under an adequacy decision. |
Eddytor's documentation site (docs.eddytor.com) carries no analytics and sets no tracking cookies.
LLM providers (activated only when you enable AI Actions)
AI Actions ("magic dust") stay off until you store an API key for a provider. The key is yours, encrypted at rest, and scoped to your user — Eddytor holds no model credentials of its own. Your relationship with the selected provider, including data handling, retention, and any training opt-out, is governed by your agreement with that provider.
| Subprocessor | Applicable services | Processing activities | Location |
|---|---|---|---|
| Anthropic PBC (Claude) | AI Actions, when selected by you | Model inference over the prompt and table context you submit | US / EU regions, depending on configuration |
| OpenAI, L.L.C. | AI Actions, when selected by you | Model inference over the prompt and table context you submit | US / global |
| Google LLC (Gemini) | AI Actions, when selected by you | Model inference over the prompt and table context you submit | US / EU regions, depending on configuration |
| Mistral AI SAS | AI Actions, when selected by you | Model inference over the prompt and table context you submit | EU (France) |
Selecting a self-hosted Ollama endpoint engages no subprocessor: inference runs on hardware you or Eddytor control, and where Eddytor hosts it, it runs in the EU.
Supporting vendors
These vendors serve the build and delivery pipeline. They receive no customer personal data, so they are listed for completeness rather than as subprocessors under the DPA.
| Vendor | Purpose | Location |
|---|---|---|
| GitHub, Inc. (Microsoft) | Source hosting, CI, and the ghcr.io container registry the production cluster pulls images from | US |
| Internet Security Research Group (Let's Encrypt) | Issues the TLS certificates for *.eddytor.com; sees hostnames only | US |
Notes
- All Eddytor self-developed services run within the EU.
- Where a subprocessor processes personal data outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs), an adequacy decision, or another safeguard the GDPR provides for.
- Eddytor does not process payment data. The Service is currently free of charge, so no payment processor is engaged. If paid plans are introduced, we will add the payment processor to this list with at least 30 days' notice.
- For any questions about subprocessors, contact privacy@eddytor.com.
Revision history
- 2026-08-26 — Register rewritten against the current production platform. Amazon Web Services removed: the Eddytor-hosted sandbox bucket it backed no longer exists (2026-06-04). Mistral AI added to the LLM providers. Matomo entry expanded with the operating entity and hosting location. Hetzner location stated as Falkenstein, Germany.
- 2026-06-11 — Stripe Payments Europe, Ltd. removed. The Service carries no billing, so no payment data is processed.
- 2026-05-26 — Supabase removed. Authentication, the metadata database, and credential encryption now run in Eddytor's own services on Hetzner hardware.
- 2026-04-27 — First published.